(List
  (FunctionDef try []
    (List
      (Com {[LIT_CHARS echo]} {[DQ [VarSub @]]})
      (AndOr OP_OR_IF
        (Com {[DQ [VarSub @]]})
        (Com {[LIT_CHARS exit]} {[LIT_CHARS 1]})
      )
    )
  )
  (Com {[LIT_CHARS try]} {[LIT_CHARS rm]} {[LIT_CHARS -rf]} {[LIT_CHARS out]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS mkdir]} {[LIT_CHARS out]})
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Create]} {[LIT_CHARS the]} {[LIT_CHARS serial]} {[LIT_CHARS number]} {[LIT_CHARS files.]})
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('serial', {[LIT_CHARS 1000]})])
  (For i [{[LIT_CHARS B]}, {[LIT_CHARS C]}, {[LIT_CHARS C2]}, {[LIT_CHARS D]}])
    (List
      (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "echo "][VarSub serial][LIT_CHARS " > out/"][VarSub i][LIT_CHARS -serial]]})
      (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('serial', {[ComSub (Com {[LIT_CHARS expr]} {[VarSub serial]} {[LIT_OTHER "+"]} {[LIT_CHARS 1]})]})])
    )
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Generate]} {[LIT_CHARS the]} {[LIT_CHARS keys.]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[LIT_CHARS out/A.key]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[LIT_CHARS out/B.key]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[LIT_CHARS out/C.key]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS genrsa]} {[LIT_CHARS -out]} {[LIT_CHARS out/D.key]} {[LIT_CHARS 2048]})
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Generate]} {[LIT_CHARS the]} {[LIT_CHARS D]} {[LIT_CHARS CSR.]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[LIT_CHARS out/D.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/D.csr]} {[LIT_CHARS -config]} {[LIT_CHARS redundant-ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "D Root CA"]]}), ('CERTIFICATE', {[LIT_CHARS D]})]
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS D]} {[LIT_CHARS signs]} {[LIT_CHARS itself.]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS x509]} {[LIT_CHARS -req]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -in]} {[LIT_CHARS out/D.csr]} {[LIT_CHARS -extensions]} {[LIT_CHARS ca_cert]} {[LIT_CHARS -extfile]} {[LIT_CHARS redundant-ca.cnf]} {[LIT_CHARS -signkey]} {[LIT_CHARS out/D.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/D.pem]} {[LIT_CHARS -text]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "D Root CA"]]})]
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Generate]} {[LIT_CHARS the]} {[LIT_CHARS C2]} {[LIT_CHARS root]} {[LIT_CHARS CSR.]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[LIT_CHARS out/C.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/C2.csr]} {[LIT_CHARS -config]} {[LIT_CHARS redundant-ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "C CA"]]}), ('CERTIFICATE', {[LIT_CHARS C2]})]
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS C2]} {[LIT_CHARS signs]} {[LIT_CHARS itself.]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS x509]} {[LIT_CHARS -req]} {[LIT_CHARS -days]} {[LIT_CHARS 3650]} {[LIT_CHARS -in]} {[LIT_CHARS out/C2.csr]} {[LIT_CHARS -extensions]} {[LIT_CHARS ca_cert]} {[LIT_CHARS -extfile]} {[LIT_CHARS redundant-ca.cnf]} {[LIT_CHARS -signkey]} {[LIT_CHARS out/C.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/C2.pem]} {[LIT_CHARS -text]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "C CA"]]})]
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Generate]} {[LIT_CHARS the]} {[LIT_CHARS B]} {[LIT_CHARS and]} {[LIT_CHARS C]} {[LIT_CHARS intermediaries] [\ LIT_ESCAPED_CHAR "\\'"]} {[LIT_CHARS CSRs.]})
  (For i [{[LIT_CHARS B]}, {[LIT_CHARS C]}])
    (List
      (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('name', {[DQ [VarSub i][LIT_CHARS " Intermediate CA"]]})])
      (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[LIT_CHARS out/] [VarSub i] [LIT_CHARS .key]} {[LIT_CHARS -out]} {[LIT_CHARS out/] [VarSub i] [LIT_CHARS .csr]} {[LIT_CHARS -config]} {[LIT_CHARS redundant-ca.cnf]}
            more_env=[('CA_COMMON_NAME', {[DQ [VarSub i][LIT_CHARS " CA"]]}), ('CERTIFICATE', {[VarSub i]})]
      )
    )
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS D]} {[LIT_CHARS signs]} {[LIT_CHARS the]} {[LIT_CHARS C]} {[LIT_CHARS intermediate.]})
  (Com {[LIT_CHARS touch]} {[LIT_CHARS out/D-index.txt]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -extensions]} {[LIT_CHARS ca_cert]} {[LIT_CHARS -in]} {[LIT_CHARS out/C.csr]} {[LIT_CHARS -out]} {[LIT_CHARS out/C.pem]} {[LIT_CHARS -config]} {[LIT_CHARS redundant-ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "D Root CA"]]}), ('CERTIFICATE', {[LIT_CHARS D]})]
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS C]} {[LIT_CHARS signs]} {[LIT_CHARS the]} {[LIT_CHARS B]} {[LIT_CHARS intermediate.]})
  (Com {[LIT_CHARS touch]} {[LIT_CHARS out/C-index.txt]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -extensions]} {[LIT_CHARS ca_cert]} {[LIT_CHARS -in]} {[LIT_CHARS out/B.csr]} {[LIT_CHARS -out]} {[LIT_CHARS out/B.pem]} {[LIT_CHARS -config]} {[LIT_CHARS redundant-ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "C CA"]]}), ('CERTIFICATE', {[LIT_CHARS C]})]
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Generate]} {[LIT_CHARS the]} {[LIT_CHARS A]} {[LIT_CHARS end-entity]} {[LIT_CHARS CSR.]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS req]} {[LIT_CHARS -new]} {[LIT_CHARS -key]} {[LIT_CHARS out/A.key]} {[LIT_CHARS -out]} {[LIT_CHARS out/A.csr]} {[LIT_CHARS -config]} {[LIT_CHARS ee.cnf]})
  (Com {[LIT_CHARS echo]} {[LIT_CHARS B]} {[LIT_CHARS signs]} {[LIT_CHARS A.]})
  (Com {[LIT_CHARS touch]} {[LIT_CHARS out/B-index.txt]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS openssl]} {[LIT_CHARS ca]} {[LIT_CHARS -batch]} {[LIT_CHARS -extensions]} {[LIT_CHARS user_cert]} {[LIT_CHARS -in]} {[LIT_CHARS out/A.csr]} {[LIT_CHARS -out]} {[LIT_CHARS out/A.pem]} {[LIT_CHARS -config]} {[LIT_CHARS redundant-ca.cnf]}
    more_env=[('CA_COMMON_NAME', {[DQ [LIT_CHARS "B CA"]]}), ('CERTIFICATE', {[LIT_CHARS B]})]
  )
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Create]} {[LIT_CHARS redundant-server-chain.pem]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/A.key out/A.pem out/B.pem out/C.pem out/D.pem "][LIT_CHARS "    > ../certificates/redundant-server-chain.pem"]]})
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Create]} {[LIT_CHARS redundant-validated-chain.pem]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS /bin/sh]} {[LIT_CHARS -c]} {[DQ [LIT_CHARS "cat out/A.key out/A.pem out/B.pem out/C2.pem "][LIT_CHARS "  > ../certificates/redundant-validated-chain.pem"]]})
  (Com {[LIT_CHARS echo]} {[LIT_CHARS Create]} {[LIT_CHARS redundant-validated-chain-root.pem]})
  (Com {[LIT_CHARS try]} {[LIT_CHARS cp]} {[LIT_CHARS out/C2.pem]} {[LIT_CHARS ../certificates/redundant-validated-chain-root.pem]})
)